POWorkspaceagentic kit · product owner
← All runs

User sign-up and sign-in, for an online flight tickets purchase site

Author backlog · innovation-group · po-d197eabb

completedcost $0.7353282000000001
[po-ticket-author running] Pipeline started — https://github.com/N-iX-GenAI-Value-LAB/observability-server/actions/runs/34430656485
[po-ticket-author running] Phase: discovery — restating intent, resolving ambiguity, building Open Decisions Resolved table for user sign-up/sign-in on a flight tickets purchase site
[po-ticket-author running] Phase: story — decomposing into 3 epics (User Registration, User Authentication, Password Recovery) with 7 sprint-sized stories in Mike Cohn format
[po-ticket-author running] Phase: ac — writing Given/When/Then acceptance criteria for all 7 stories, covering happy paths, validation errors, failure paths, and edge cases
[po-ticket-author running] Jira issue creation blocked: POST to project KAN returned "The target project does not exist or you do not have permission to create issues in it." — backlog is linted clean (3 epics, 7 stories, 31 AC); jira_keys will be empty until KAN project access is confirmed
[po-ticket-author completed] Backlog authored and posted: 3 epics, 7 stories, 31 AC bullets — linter clean. Jira issue creation blocked on KAN project access (see warning above). Backlog available at result endpoint.

Backlog

Epic: User Registration3 stories
  1. Registration form submission with valid data
    • Given I am on the /register page with all fields empty, When I enter a valid first name, last name, email address, password meeting all rules, and matching password confirmation and click 'Create Account', Then POST /api/auth/register returns HTTP 201 and I am redirected to a page displaying 'Check your email to verify your account.'
    • Given I submit the registration form with the first name field empty, When client-side validation runs on submit, Then the first name field shows the inline error 'First name is required' and no network request is made.
    • Given I submit the registration form with an already-registered email address, When POST /api/auth/register returns HTTP 409, Then the email field shows the inline error 'An account with this email already exists' and both password fields are cleared.
    • Given the registration form is submitted with all valid data, When POST /api/auth/register fails with HTTP 500, Then a toast notification reads 'Registration failed — please try again' and all form field values are preserved.
    • Given more than 10 registration requests originate from the same IP within 60 seconds, When the 11th request reaches POST /api/auth/register, Then the server returns HTTP 429 with body {"error":"rate_limit_exceeded"}.
  2. Password rule enforcement during registration
    • Given I am typing in the password field on /register, When the current input length is fewer than 8 characters, Then the 'Minimum 8 characters' rule indicator displays a red error icon and the 'Create Account' button has the disabled attribute set.
    • Given I am typing in the password field and the input is 8 or more characters, When the input contains no digit (0-9), Then the 'At least one number' rule indicator displays a red error icon and the submit button remains disabled.
    • Given I am typing in the password field and the input is 8 or more characters with at least one digit, When the input contains no special character from the set !@#$%^&*()-_=+[], Then the 'At least one special character' rule indicator displays a red error icon and the submit button remains disabled.
    • Given I am typing in the password field, When the input satisfies all three rules (length >= 8, at least 1 digit, at least 1 special character), Then all three rule indicators display green success icons and the submit button's disabled attribute is removed.
    • Given I have entered a valid password in the password field, When I enter a different string in the 'Confirm password' field and move focus away, Then the confirm field shows the inline error 'Passwords do not match' and the submit button remains disabled.
  3. Email verification after registration
    • Given registration completes for email address 'traveler@example.com', When POST /api/auth/register returns HTTP 201, Then within 60 seconds an email is delivered to that address with subject 'Verify your email' and a body containing a link matching the pattern https://<domain>/verify-email?token=<alphanumeric-token>.
    • Given I click a verification link with a valid unexpired token, When GET /api/auth/verify-email?token=<token> returns HTTP 200, Then I am redirected to /sign-in and a banner element with role='status' reads 'Email verified! You can now sign in.'
    • Given I click a verification link whose token is older than 24 hours, When GET /api/auth/verify-email?token=<token> returns HTTP 410, Then the page shows the heading 'This verification link has expired' and a button labelled 'Resend verification email'.
    • Given I attempt POST /api/auth/sign-in with valid credentials before verifying my email, When the server returns HTTP 403 with {"error":"email_not_verified"}, Then the sign-in form displays the banner 'Please verify your email before signing in' and a 'Resend verification email' anchor link is visible.
Epic: User Authentication2 stories
  1. Sign-in with valid credentials and account lockout
    • Given I am on the /sign-in page with valid registered credentials, When I enter the correct email and password and click 'Sign In', Then POST /api/auth/sign-in returns HTTP 200, the response sets a cookie named 'session_id' with the HttpOnly and Secure flags, and I am redirected to /dashboard.
    • Given I am on the /sign-in page, When I submit an incorrect password for a registered email, Then POST /api/auth/sign-in returns HTTP 401, the form displays 'Incorrect email or password', and GET /api/auth/login-attempts returns a failed_count incremented by 1.
    • Given I have made 4 consecutive failed sign-in attempts for my account, When I submit a 5th incorrect password, Then POST /api/auth/sign-in returns HTTP 423 with {"error":"account_locked","unlock_after_seconds":900} and the form displays 'Account locked — try again in 15 minutes.'
    • Given my account has been locked for exactly 15 minutes, When I submit the correct credentials, Then POST /api/auth/sign-in returns HTTP 200 and GET /api/auth/login-attempts returns failed_count equal to 0.
    • Given I am on the /sign-in page, When I click 'Sign In' with the email field empty, Then no POST request is made and the email field shows the inline error 'Email is required.'
  2. Persistent session via Remember Me
    • Given I sign in with the 'Remember me' checkbox checked, When POST /api/auth/sign-in returns HTTP 200, Then the Set-Cookie header for 'session_id' includes Max-Age=2592000 and both the Secure and HttpOnly flags.
    • Given I sign in without the 'Remember me' checkbox checked, When POST /api/auth/sign-in returns HTTP 200, Then the Set-Cookie header for 'session_id' contains no Max-Age attribute, making it a session cookie that is cleared when the browser session ends.
    • Given I have an active 30-day session cookie, When I close and reopen the browser and navigate to /dashboard, Then GET /api/me returns HTTP 200 and I remain on the authenticated dashboard without re-entering credentials.
    • Given I am authenticated and click 'Sign Out', When POST /api/auth/sign-out returns HTTP 200, Then the Set-Cookie response header contains 'session_id=; Max-Age=0' and a subsequent GET /api/me returns HTTP 401.
Epic: Password Recovery2 stories
  1. Request password reset link
    • Given I am on the /forgot-password page, When I enter any email address (registered or not) and click 'Send Reset Link', Then POST /api/auth/forgot-password returns HTTP 200 and the page displays 'If an account with that email exists, a reset link has been sent.'
    • Given I submit a forgot-password request for a registered email and the server processes it successfully, When within 10 minutes, Then an email arrives at that address with subject 'Reset your password' and a link matching https://<domain>/reset-password?token=<alphanumeric-token>.
    • Given more than 3 reset requests have been made for the same email within 60 minutes, When the 4th request is submitted to POST /api/auth/forgot-password, Then the server returns HTTP 429 with {"error":"rate_limit_exceeded"} and the page shows 'Too many requests — please try again later.'
  2. Reset password via email link
    • Given I navigate to /reset-password?token=<valid-token>, When the page loads and the token is confirmed valid, Then the form renders two fields labelled 'New password' and 'Confirm new password' and all three password-rule indicators are visible.
    • Given I have entered a new password meeting all three rules and a matching confirmation, When I click 'Set New Password' and POST /api/auth/reset-password returns HTTP 200, Then I am redirected to /sign-in and a banner reads 'Password updated — please sign in with your new password.'
    • Given I attempt to submit a new password that violates a rule (length < 8, no digit, or no special character), When client-side validation runs, Then the non-compliant rule indicator shows a red error icon, the submit button remains disabled, and no network request is made.
    • Given I follow a reset link whose token is older than 1 hour, When POST /api/auth/reset-password returns HTTP 410, Then the page displays 'This reset link has expired' and a button labelled 'Request a new reset link'.
    • Given a reset token has already been successfully used once, When I submit the same token again and POST /api/auth/reset-password returns HTTP 410, Then the page displays 'This reset link has already been used.'